CVE-2026-98626

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Restrict CO-RE poisoning to relocatable instructions

CO-RE relocation records can name any instruction offset. When a

relocation cannot be resolved, bpf_core_patch_insn() currently poisons its

target before checking whether that instruction is a valid relocation

target. Malformed metadata can therefore replace jumps, calls, exits,

register-source arithmetic, or non-immediate loads instead of failing at

the relocation step.

Handle poisoning only after the instruction has passed the same class and

operand-form checks used for a resolved relocation. Route invalid forms

through the existing diagnostic and return a hard error. Keep poisoning

supported instructions, including both halves of a plain ldimm64, so an

unresolved relocation in dead code remains valid.

Extend bpf_core_poison_insn() to poison both halves of ldimm64, and return

its status directly from each validated instruction case. This avoids

routing the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References